EveryAILaw.comDoes Iowa Conversational AI Services Act (SF 2417) require Data Governance?
Iowa • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 3 specific requirements for Data Governance across 1 provision:
- Minor self-service controls — Offer tools for minor account holders to manage their own privacy and account settings (§ 554J.2(5)(a))
- Guardian controls under 13 — Offer tools for the parent or guardian of a minor account holder under thirteen years of age to manage the minor's privacy and account settings (§ 554J.2(5)(b))
- Risk-calibrated guardian controls — Offer tools for the parent or guardian of a minor account holder to manage the minor's privacy and account settings as appropriate based on relevant risks (§ 554J.2(5)(c))
Minor Privacy and Parental Control Tools #
The statute requires the tools to exist but says nothing about what they must control, so the compliance floor is a settings surface rather than a defined set of parental permissions. The § 554J.2(5)(c) "as appropriate based on relevant risks" formulation is the only risk-proportionate duty in the chapter and is left entirely to the Attorney General's chapter 17A rulemaking to give content.
Requirements
| Requirement | Details |
|---|---|
| Minor self-service controls | Offer tools for minor account holders to manage their own privacy and account settings (§ 554J.2(5)(a)) |
| Guardian controls under 13 | Offer tools for the parent or guardian of a minor account holder under thirteen years of age to manage the minor's privacy and account settings (§ 554J.2(5)(b)) |
| Risk-calibrated guardian controls | Offer tools for the parent or guardian of a minor account holder to manage the minor's privacy and account settings as appropriate based on relevant risks (§ 554J.2(5)(c)) |
Penalties
| Violation | Fine |
|---|---|
| Any violation of chapter 554J | Injunction plus the greater of actual damages or a civil penalty of $1,000 per violation, capped at $500,000 per operator (§ 554J.6(1)) |
| Enforcement | Attorney General only; no private right of action (§ 554J.6(2), § 554J.6(4)) |